# OUTSYDE – only /public is meant to be reachable over HTTP.
# Blocks direct requests to .env, config.php, app/, database/, storage/, composer files, etc.
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Visiting the project root sends people to the real web root
    RewriteRule ^$ public/ [R=302,L]
    # Everything that is not under public/ is forbidden
    RewriteRule ^(?!public/) - [F,L]
</IfModule>
